Self Xss on File Replace #50481 Valid Cross-site Scripting – 2015-07-08 – 1 SQL Injection Vulnerability in Concrete5 version 5.7.3.1 #59664 Valid SQL Injection – 2015-06-11 – 1 No csrf protection on index.php/ccm/system/user/add_group, index.php/ccm/system/user/remove_group #64184 Valid Cross-Site Request Forgery – 2015-08-26 – 1 ProBlog 2.6.6 CSRF Exploit #133847 Valid Cross-Site Request Forgery – 2016-05-22 – 1 Full Page Caching Stored XSS Vulnerability #148300 Informative Cross-site Scripting – 2017-04-11 – 1 Host Header Injection allow HiJack Password Reset Link #301592 Duplicate No weakness recorded – 2018-01-12 – 1 XSS in Theme Preview Tools File #4777 Valid Cross-site Scripting – 2014-08-28 – 2 dashboard/pages/types [Unknown column 'Array' in 'where clause'] disclosure. #4811 Valid Information Disclosure – 2014-06-09 – 2 CONCRETE5 - path disclosure. #4931 Valid Information Disclosure – 2014-06-09 – 2 Cross-Site Scripting in getMarketplacePurchaseFrame #6843 Valid Cross-site Scripting – 2014-08-18 – 2 Weak random number generator used in concrete/authentication/concrete/controller.php #31171 Valid Cryptography – 2014-10-26 – 2 Stored XSS in adding fileset #42248 Valid Cross-site Scripting – 2016-04-26 – 2 Stored XSS on Blog's page Tile #50552 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS on Title of Page List in edit page list #50554 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS on Search Title #50556 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Title of the topic List #50626 Valid Cross-site Scripting – 2015-07-08 – 2 Stored Xss in Feature Paragraph #50642 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Testimonial name #50644 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Testimonial Position #50645 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in testimonial Company #50656 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS In Company URL #50662 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Bio/Quote #50779 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Message to Display When No Pages Listed. #50780 Valid Cross-site Scripting – 2015-07-08 – 2 Stored XSS in Image Alt. Text #50782 Valid Cross-site Scripting – 2015-07-08 – 2 Multiple Reflected Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1 #59661 Valid Cross-site Scripting – 2015-06-06 – 2 Multiple XSS Vulnerabilities in Concrete5 5.7.3.1 #62294 Valid Cross-site Scripting – 2015-07-15 – 2 No CSRF protection when creating new community points actions, and related stored XSS #65808 Valid Cross-site Scripting – 2015-08-26 – 2 Content Spoofing possible in concrete5.org #168078 Valid Misconfiguration and Insecure Design – 2017-07-23 – 2 Administrators can add other administrators #304642 Informative Access Control – 2020-05-11 – 2 https://concrete5.org ::: HeartBleed Attack (CVE-2014-0160) #6475 Valid Information Disclosure – 2014-04-09 – 3 Stored XSS in concrete5 5.7.0.4. #30019 Valid Cross-site Scripting – 2015-03-11 – 3 SQL injection in conc/index.php/ccm/system/search/users/submit #38778 Valid SQL Injection – 2016-04-26 – 3 stored XSS in concrete5 5.7.2.1 #38890 Valid Cross-site Scripting – 2016-04-26 – 3 Stored XSS in Contact Form #50564 Valid Cross-site Scripting – 2015-07-08 – 3 Stored XSS in title of date navigation #50627 Valid Cross-site Scripting – 2015-07-08 – 3 Stored XSS in Feature tile #50639 Valid Cross-site Scripting – 2015-07-08 – 3 Multiple Cross Site Request Forgery Vulnerabilities in Concrete5 version 5.7.3.1 #59660 Valid Cross-Site Request Forgery – 2016-06-26 – 3 Multiple Stored Cross Site Scripting Vulnerabilities in Concrete5 version 5.7.3.1 #59662 Valid Cross-site Scripting – 2016-06-26 – 3 Sendmail Remote Code Execution Vulnerability in Concrete5 version 5.7.3.1 #59663 Valid Command and Code Injection – 2015-06-06 – 3 Unsafe usage of Host HTTP header in Concrete5 version 5.7.3.1 #59666 Informative Misconfiguration and Insecure Design – 2018-01-11 – 3 /index.php/dashboard/sitemap/explore/ Cross-site scripting #4808 Valid Cross-site Scripting – 2014-06-09 – 4 page_controls_menu_js can reveal collection version of page #4938 Valid Information Disclosure – 2014-03-31 – 4 Stored XSS in RSS Feeds Title (Concrete5 v8.1.0) #221380 Valid Cross-site Scripting – 2017-05-17 – 4 open redirect to a remote website which can phish users #1397804 Informative Open Redirect – 2022-11-25 – 4 Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text" #616770 Valid Cross-site Scripting – 2021-10-04 – 5 Stored XSS on express entries #873474 Valid Cross-site Scripting – 2020-07-03 – 5 Phar Deserialization Vulnerability via Logging Settings #1063039 Valid Deserialization and Object Injection – 2021-09-24 – 5 XSS IN member List (Because of City Textbox) #4839 Valid Cross-site Scripting – 2014-04-16 – 6 XSS on [/concrete/concrete/elements/dashboard/sitemap.php] #6853 Valid Cross-site Scripting – 2014-08-28 – 6 FULL PATH DISCLOSUR #7736 Valid Information Disclosure – 2014-04-17 – 6